CORS block on /v2/card-payments in Sandbox Mode

## Description

When using the AbacatePay hosted checkout page in **Sandbox Mode** (dev API key `abc_dev_*`), credit card payments fail due to a CORS policy error. PIX payments work correctly with the "Simular Pagamento" button.

## Steps to Reproduce

1. Create a billing using the dev API key (`abc_dev_*`)
2. Open the hosted checkout URL (e.g., `https://app.abacatepay.com/pay/bill_xxx`)
3. Page correctly shows **"Sandbox Mode - Ambiente de teste"**
4. Fill in customer info and click "Continuar"
5. Select **"Crédito"** payment method
6. Fill in card details (name, number, expiry, CVC, CEP, residential number)
7. Click **"Pagar agora"**

## Expected Behavior

The sandbox should either:
- Process the test card payment (like PIX does with "Simular Pagamento")
- Show a "Simular Pagamento" button for card payments as well

## Actual Behavior

The browser console shows:

```
Access to fetch at 'https://api.abacatepay.com/v2/card-payments' from origin 'https://app.abacatepay.com'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Failed to load resource: net::ERR_FAILED @ https://api.abacatepay.com/v2/card-payments
```

The button shows "Trabalhando nisso..." and nothing happens. No error message is displayed to the user.

## Workaround

Use PIX payment method instead, which works correctly in sandbox with the "Simular Pagamento" simulation button.

## Environment

- Browser: Chromium (Playwright)
- API Key type: `abc_dev_*` (sandbox/dev)
- Checkout URL: `https://app.abacatepay.com/pay/bill_*`
- Date: 2026-02-17